https://go2docs.graylog.org/5-2/getting_in_log_data/gelf.html

# GELF
The Graylog Extended Log Format (GELF) is a log format that avoids the shortcomings of classic plain syslog:

Limited to length of 1024 bytes. Inadequate space for payloads like backtraces.
No data types in structured syslog. Numbers and strings are indistinguishable.
The RFCs are strict enough, but there are so many syslog dialects out there that you cannot possibly parse all of them.
No compression.
Syslog is sufficient for logging system messages of machines or network gear, while GELF is a strong choice for logging from within applications. There are libraries and appenders for many programming languages and logging frameworks, so it is easy to implement. GELF can send every exception as a log message to your Graylog cluster without complications from timeouts, connection problems, or anything that may break your application from within your logging class because GELF can be sent via UDP.

# GELF Payload Specification
Version 1.1 (11/2013)

A GELF message is a JSON string with the following fields:

| field                     | type                         | desc                                                                                                                                                                                                                                                                                                                                                                                     |
| ------------------------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **version**               | `string (UTF-8)`             | GELF spec version – “1.1”; MUST be set by the client library.                                                                                                                                                                                                                                                                                                                            |
| **host**                  | `string (UTF-8)`             | the name of the host, source or application that sent this message; MUST be set by the client library.                                                                                                                                                                                                                                                                                   |
| **short_message**         | `string (UTF-8)`             | a short, descriptive message; MUST be set by the client library.                                                                                                                                                                                                                                                                                                                         |
| _**full_message**_        | `string (UTF-8)`             | a long message that can contain a backtrace; optional.                                                                                                                                                                                                                                                                                                                                   |
| _**timestamp**_           | `number`                     | seconds since UNIX epoch with optional decimal places for milliseconds; _SHOULD_ be set by the client library. If absent, the timestamp will be set to the current time (now).                                                                                                                                                                                                       |
| _**level**_               | `number`                     | the level equal to the standard syslog levels; optional. Default is 1 (ALERT).                                                                                                                                                                                                                                                                                                       |
| _**facility**_            | `string (UTF-8)` an          | optional, deprecated. Send as additional field instead.                                                                                                                                                                                                                                                                                                                                |
| _**line**_                | `string (UTF-8)`             | the file (with path, if you want) that caused the error (string); optional, deprecated. Send as an additional field instead.                                                                                                                                                                                                                                                           |
| _**_[additional field]**_ | `string (UTF-8)` or `number` | every field you send and prefix with an underscore ( `_`) will be treated as an additional field. Allowed characters in field names are any word character (letter, number, underscore), dashes and dots. The , verifying regular expression is: `^[\\w\\.\\-]*$`. Libraries SHOULD not allow to send id as additional field ( `_id`). Graylog server nodes omit this field automatically. |
